We release patches for security vulnerabilities for the latest major version of each SDK. Older versions may receive fixes on a best-effort basis.

Please do not report security vulnerabilities through public GitHub issues.

Instead, send an email to security@verifiedsms.com.

You should receive a response within 48 hours. If for some reason you do not, please follow up via the same channel.

• A clear description of the vulnerability
• Steps to reproduce (proof of concept code is helpful)
• The affected SDK and version
• Any potential impact you have identified

• We will acknowledge receipt of your report within 48 hours.
• We will investigate and determine the severity and impact.
• We will keep you informed as we work on a fix.
• Once a fix is ready, we will release a patch and publicly disclose the vulnerability with credit to you (unless you prefer to remain anonymous).

We prefer all communications to be in English.

When we receive a security bug report, we will:

1. Confirm the problem and determine affected versions.
2. Audit code to find any similar potential problems.
3. Prepare fixes for all supported versions (see table above).
4. Release new versions and update the affected SDKs.
5. Publish a security advisory on GitHub and credit the reporter (if desired).

Thank you for helping keep VerifiedSMS and our users safe.